CISSP Blog Post 24, Domain 7: Disaster Planning and Restoration

Credit: Post based on CISSP course presented by Dennis Lee, November 2018

Ok, you’ve (hopefully) backed up your data in the last post, so now let’s talk Disaster Planning and restoration.

Some unforeseen factors when planning that you should be aware of may include:

• Your backup site is also impacted by the disaster
• You cannot get to your backup site
• If you have a hot site, it may not be able to accommodate multiple customers all having an issue at the same time
• Your employee’s families may need care as well, reducing available support staff

So what’s the goal of restoration? The goal is to return to your original site with original capacity and data.

Recovery vs. Restoration

Restoration phases include:

1. Is the incident ended?
2. Is it safe to return?
3. Document the losses
4. Salvage the assets
5. Repairs & replacement
6. Return to site (Tier 5 first, all the way up to Tier 1 support employees)
7. Closure – lessons learned, official end of disaster

Pro tip: When you’re documenting your plan put a 1-year expiration date on the plan to force updates and make it obvious which is most recent version.

Speaking of version control – obsolete plans should be:

1. Archived
2. Collected
3. Confirm collection
4. Issue new plan
5. Destroy old plans

Oh… also you – need to be testing your plan. You can do so in multiple ways including:

Testing Type	Method
Checklist or Desk Check	Give each business unit (BU) a copy of the plan and have them run through a checklist to ensure all relevant points are covered.
Structured Walk-through / Tabletop Exercise	Key players get together and review plan collectively.
Simulation Test	Practice drill mobilizing the personnel (e.g. Fire Drill) and rehearse going to assembly point.
Parallel Test	Operational test at alternate site running in parallel with main site (production).
Full Interruption Test	Shutdown production environment and run a live environment at alternate site. Need to have prior management written permission before parallel test conducted.

CISSP Blog Post 23, Domain 7: Digital Backups

Credit: Post based on CISSP course presented by Dennis Lee, November 2018

Welcome to February 2021! This month I plan to wrap up our CISSP blog post series.

Let’s start by talking about data backups! There are lots of ways to do data backups:

• A Full backup is exactly what it sounds like – all your data is copied to another location and backed up.
• A Differential backup is where all data that’s changed since the last full backup is copied.
• An Incremental backup is where all data that has changed since the last full OR incremental backup, is backed up. This is easier to restore from but you will need more time and media storage space.

Cost and Capability Comparison of Backup Sites

Some technology that can be useful for creating backups is a Redundant Array of Independent Disks (aka RAID). Again, lots of choices:

RAID 0 – Stripping of data – very fast, no recovery! 2 drives minimum required.

RAID 0

RAID 1 – Mirroring – double storage cost, slower, 2 drives minimum required.

RAID 1

RAID 3 & 4 – RAID 3 reads and writes data at the byte level. RAID 4 reads and writes at the block level. You can only lose 1 active drive at a time. If the parity drive fails, the RAID falls back to RAID 0 or you can rebuild the parity drive back on a spare drive. This requires 3 drives minimum and only gives 2 drive capacity.

RAID 3 & 4

RAID 5 is faster because parity info is written in parallel. If there is no spare drive, it will reconstruct lost data and parity info into system memory in chunks. It needs 3 drives minimum, with a 2 drive capacity.

RAID 6 (Enhanced RAID 5) provides 2-dimensional parity, allowing for the loss of 2 drives simultaneously. It needs 1 extra drive than a RAID 5. Requires 4 drives minimum, with a 2 drive capacity.

RAID 5 & 6

You can also combine RAID’s: e.g. 0+1, 1+0, 1+5, 5+1, etc.